85f2c33bd270e95170ff8a249ff7c054ce2ad4044c41d6c9d989e7a914ac4cd0[.]exe

resource
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

85f2c33bd270e95170ff8a249ff7c054ce2ad4044c41d6c9d989e7a914ac4cd0.exe

IMPHASH 671f2a1f8aee14d336bab98fea93d734
SHA256 85f2c33bd270e95170ff8a249ff7c054ce2ad4044c41d6c9d989e7a914ac4cd0
MD5 21ea616cf4f0df2053beae6f4c625213
SHA1 5b2399a6b7b87f19604bb94a4ebb3bc364b618ce
SHA512 5db9def0e9e9e99ecb6e43047c11e31ea87b08ba0deff652e11c95629f45f8bd037b718d023a499660d5696f331d4bf8d90d7c733f4181cd285811419697c7ed
SSDEEP 49152:A8jXGmnj2u/T6aFh4yHp3dWojuja2wZjyOeT:PrGqXxFhVHp3dHjd2EBeT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

03:cf:3f:83:b6:cc:02:af:30:04:0b:92:0e:08:00:77:57:29:19:49:4b:ad:ff:cb:55:1c:c6:9e:be:52:74:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Lgnagtige Underhorsemen\ ,O=Oculinid,L=Sartrouville,ST=Île-de-France,C=FR

Chains

Aug 22, 2024

Minor OS version

0

Major OS version

4

Entry point

13218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteExA

ole32

OleUninitialize OleInitialize IIDFromString CoCreateInstance CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcA GetMessagePos CheckDlgButton LoadCursorA SetCursor GetSysColor SetWindowPos GetWindowLongA IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetDlgItemTextA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint MessageBoxIndirectA CharPrevA PeekMessageA GetClassInfoA DispatchMessageA TrackPopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor

kernel32

CreateFileA GetTempFileNameA ReadFile RemoveDirectoryA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersionExA lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA WriteFile ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc GetModuleHandleA LoadLibraryExA FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA MulDiv lstrcpyA MoveFileExA lstrcatA WideCharToMultiByte GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableA

$PLUGINSDIR/BgImage.dll

IMPHASH 0bf743a799aa40ec407e829cce14f6c8
SHA256 785944e57e8e4971f46f84a07d82dee2ab4e14a68543d83bfe7be7d5cda83143
MD5 2d5f40ddc34e9dc8f43b5bf1f61301e3
SHA1 5ed3cd47affc4d55750e738581fce2b40158c825
SHA512 605cebcc480cb71ba8241782d89e030a5c01e1359accbde174cb6bdaf249167347ecb06e3781cb9b1cc4b465cef95f1663f0d9766ed84ebade87aa3970765b3e
SSDEEP 96:8eQMA6z4f7TI20Y1wircawlkX1b3+LDfbAJ8uLzqkLnLiEQjJ3KxkP:tChfHv08wocw3+e8uLmyLpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH cfc8bb9e11188db414351d2620c98f39
SHA256 b2699fdfdab6a018fcc972806d12f71972de1861660bb6578935d62b1da06504
MD5 3cea4c9994912d8f3c3e8b6a814e810e
SHA1 c48d34a0981d4ab576c7a3ab566f5ddb94af5d86
SHA512 d317449f3c3115e279cff148c3e0bccc9b1d4ba82d1f85c0b99d7db657e85f752c0691d33f8024ada5850c993d0bdcbcc70b296b7cf33d7d14a67bc16ca3b4a3
SSDEEP 96:o417lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx4Lb8qndYv0PLE:oOl7wrLBn0REc0JxEdO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Fletcher/Fiskestimes/Gate.pri

SHA256 1312885814b08bdc0b9eab2c8066c6ab9960458e966b334fae8c238ac07fec89
MD5 73e04a3ebab143c253a070c84db8e922
SHA1 a17a157d99e571539567e72ba78e860c39305493
SHA512 f0a5260d2bbf6cd824e72daa6d3e37aef71b8518e126af5db4ed364c4283ae70d7d78d7d802dec0e634719b309d2400091e7e1c857d515ba17950796cdbbf64b
SSDEEP 6144:3QyNdKTixkYaOeGiNg61P3T9HCqqRVEeZ:ZdAQnR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fletcher/Fiskestimes/Statsskattedepartement.Und

SHA256 892a8d3adbaffe60fc92c987ceda41bed9286c0039624fda572feb30ec913e82
MD5 adb2583a0a9116209ff02d0d8f46486a
SHA1 fe9870e0021d08784fbb3f6a30983c06561e3b00
SHA512 bb06e50b6cd40fb554e421efc077b889b409c2d0657e31cea2fd8d6a0fe2f4e5dfcdf569d7abd5ec00347375d89b775b0a25d20e9b262db4b5049ae2372df6d1
SSDEEP 768:GCbLo26BhjVbijD5Ww5y9K6xgIEy0k9REqrh8d6yDllvj8ghU8VHKaXpO2SwcKdi:vbLiNbRaivqIEVkrEAS4yDVHqaXZUH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fletcher/Fiskestimes/sitre/egenpensionernes.hjo

SHA256 d87f88b3637e07fafaab1529a46d7e88f7a3316e8a7e086bd2f1ac9a0d4e964e
MD5 b0454b46042c0367fa0729df3301176b
SHA1 de815e4f90ea287c45c8d6a5de003665e6a5920c
SHA512 145706824f8c0330828b8f271189fe4d747e3721332f07bb81605ee8afed1f5ae19d723b8d552ff73f8f15cb3d60d0305c522eb43997e0b3fe9e9b1517c4960f
SSDEEP 3072:ptMbNdHAWJ5eWgLE9W+uonWpeWVVVK/jnbdNtkGjPdkreT4dnhky7dtTZzM:DsNNACzgLEs+uoCeuVVKrbDBj6qm1XZw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fletcher/Fiskestimes/sitre/knudepunktstrafikken.sma

SHA256 c3be3445d0b49fcb6fa683518e257d06d9d647f10a33f953249f21415f5eea32
MD5 d2a604debcead67f281851485d4c58e6
SHA1 4baae6808e632dd7e35be63fbe14ba63a2ac788f
SHA512 8f769eda80fe6c8a44f0f9b9a473e6dab071eaefce12b59183bdf86d873fab8fbb8724c0a1d1c0642f4d11a5eaceb816db1f018c2705248caeca5d12569136ee
SSDEEP 3072:lU7ZOpLDP4HD2FGUu7FWb3ccwhkibCvclrj0mT8dbzhhtEdEA:qtWDTF9uRWj8kib3fYdnhkSA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fletcher/Fiskestimes/sitre/rustendes.ass

SHA256 17742ba337c2bc26b09d4a1a6bb77c337688515337ff1f6d86d9f032ca7cc2aa
MD5 5bca2372caf70a8599c494e819daee42
SHA1 cfe8b332176271ee5a13cbf03f8bf24fce6dcd02
SHA512 7b8dba5934042b0bab6cf66ef54f3f6babfcd677db8bba654c9d25d4bd0c41f8c4be4fd75958f04b35f4d3020fe05fdcc7ea088125a39afb05bbfb830754915e
SSDEEP 6144:2UIqiIwmZXWeFXlR4DMM+XvIwQ2WogHNzvWeO:Vb1weFog/8HO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fletcher/Fiskestimes/sitre/tevarmere.txt

SHA256 7808068c80de889f9b5739f4c13b700781e51585cbaa44c543b2f133ca49661c
MD5 b2bea766444a07064a76ca325a107c20
SHA1 c57092643a52458eadb1532c9cb8810e1fc757cf
SHA512 9b23564154556fa10605ffeb93c7f8b5598490011b1eb2d82a8c3f6927ce7cdbd9d66b91c127131448ffebfc73b834fbeb6c5f3edb6bed41a420f024d260f525
MD5 SHA1 SHA512

NSIS installer

installer

Fletcher/Fiskestimes/sitre/unanachronistically.pre

SHA256 7193a616744d34264d9e0f3575dec168f783209298797c16df40a7ae13894ada
MD5 5746a54892e27541b31a71a3fc62e0ce
SHA1 a6eec088678db6ece3ba711d570c8ac75d65fc87
SHA512 af478ebac39d90dd0ffb279c8dc251f803d8826a632e9f2767daaea41fbeddca2040512966b94125877189e8ef3a2d175e0245f65de3381af8f6944fa0e4d975
SSDEEP 3072:s46Hwq+eX+gvQDjEbLcClSrwNX0xAVuz/8uYSPLIUEsys8O95YcMQnWcyupOh7p:s4U+nDjEbwCQwNXZw7Trys89cxWc5ON
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Fletcher/Nummerbetegnelser.Til

SHA256 65b10764bccc224edc6cf0a1bd11285bd298fdacd99f6efed6b659d1cda140f0
MD5 25e5fc4d9ff6f0a434fbcd2b7096dee3
SHA1 13298468967b4c9512ab68926c21f10b4887f410
SHA512 394b3ef3dc28f86e295f3bae91eef9768681ae11b825b18253e6063509e3a05c20c495fe01716130a6c1d41fadcc8220478280cdde9b894bc5c2469dda3d595d
SSDEEP 6144:VWNTXO+0XZ216/kWZu57Gj+FWHxJyLkEhmPUAoDeXaGW01m+cBCY:sT++0Xw1kkWZ6g+FWGLBoMbk1Z0D
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

85f2c33bd270e95170ff8a249ff7c054ce2ad4044c41d6c9d989e7a914ac4cd0.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Fletcher/Fiskestimes/Gate.pri

Fletcher/Fiskestimes/Statsskattedepartement.Und

Fletcher/Fiskestimes/sitre/egenpensionernes.hjo

Fletcher/Fiskestimes/sitre/knudepunktstrafikken.sma

Fletcher/Fiskestimes/sitre/rustendes.ass

Fletcher/Fiskestimes/sitre/tevarmere.txt

Fletcher/Fiskestimes/sitre/unanachronistically.pre

Fletcher/Nummerbetegnelser.Til

Sharing

General

Malware Config

Signatures

File Explorer

85f2c33bd270e95170ff8a249ff7c054ce2ad4044c41d6c9d989e7a914ac4cd0.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Fletcher/Fiskestimes/Gate.pri

Fletcher/Fiskestimes/Statsskattedepartement.Und

Fletcher/Fiskestimes/sitre/egenpensionernes.hjo

Fletcher/Fiskestimes/sitre/knudepunktstrafikken.sma

Fletcher/Fiskestimes/sitre/rustendes.ass

Fletcher/Fiskestimes/sitre/tevarmere.txt

Fletcher/Fiskestimes/sitre/unanachronistically.pre

Fletcher/Nummerbetegnelser.Til